Executive brief
AVideo is a self-hosted video platform that allows administrators to manage user accounts and channels. This vulnerability allows attackers to change any user's channel password without proper authorization by exploiting a missing CSRF check. An attacker can craft a malicious webpage that, when visited by a logged-in administrator, will silently modify or clear any channel password, effectively locking creators out of their own content or removing password protection.
Technical details
The setPassword.json.php endpoint in the CustomizeUser plugin lacks CSRF token validation and does not require POST method, allowing GET requests to modify channel passwords. The vulnerable code reads users_id and ProfilePassword directly from $_REQUEST without CSRF protection, relying only on an admin privilege check. An unauthenticated attacker can craft a malicious webpage (e.g., an img tag referencing the endpoint with malicious parameters) that executes in the browser of a logged-in administrator, triggering User::setProfilePassword() with attacker-controlled values. The fix requires implementing forbidIfNotPost() and forbidIfInvalidToken() checks before the password setter is called. No patch is currently available as of the advisory date.
Affected products
- WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23)
Timeline
- 2026-08-26: disclosed: GitHub Security Advisory (GHSA-h8vg-wg8w-4r6v) published
- 2026-09-10: advisory: CVE-2026-88872 assigned and published